leptris 1.9.311.1-arm-linux → 1.9.311.2-arm-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: df4785eab905b23b3ababb440d2c0f47051bf0f7acde2c6631216828d4fa10d1
-  data.tar.gz: 4f8488030ff6e479afc2ebdc59075cd3c92e5f7c17d986731195df6aad13621a
+  metadata.gz: fc322e484037235b28d726c88ac8e036f5321bc17c95561c60ca90b3aa9b4d4a
+  data.tar.gz: 6388d7a7b8715785ac6bcdb734b82848c4e1683f72f5f81c7e6556fd255ba5da
 SHA512:
-  metadata.gz: 7fe50d8bc07f07ce47a09539df0def21e0e75716ee96afb471b2f82c5d6687f0e73544bd5afc185ae8767e7576b8e664f27b2e50cb2df7763e616668f28ba51f
-  data.tar.gz: 3646cd773bcace3e4f0023b8f5fc80680969062228b458ff2ff296b44bf88f206261caebedb185871eca81a97a583df5579040d6cceb960f67a2d21e3ed3adf3
+  metadata.gz: 486358f50f20bb8633919fab3159648e916efc984b5cc6813d641fb89c0cb463cab47e5c7c50dd5832ce6f993d28055901a2b1fe050d496c3a33531f8e54d9e9
+  data.tar.gz: ef13ab80d77dbae815f3cad97223a69a0574095df2def3b28ef1e846b538ad4bcf3c76dc70ccfc778690ccb0420f7fdbdc3fdc712bae4a18d672cf5c378d7b83

data/CHANGELOG.md

@@ -1,3 +1,20 @@
+## [1.9.311.2] - 2026-10-06
+
+### Fixed
+
+- **Absorbed sources alive at exit no longer double-free the pool
+  (#386)**: `Document#absorb`'s handle-only contract was enforced
+  only by the explicit `#free` — the C lifetime handle's dfree
+  and the no-native Ruby finalizer still called
+  `leptris_document_free`, destroying a pool already owned (and
+  released) by the absorber. Libraries that pin adopted-source
+  documents (moxml's lifetime pins) aborted at exit-time
+  finalization (`leptris_pool_destroy` → `free_small_botch`). The
+  absorbed flag now lives where every release path reads it: the
+  shared `Freed` struct (Ruby finalizer) and the C handle
+  (`doc_handle_mark_absorbed`; dfree is handle-only when the pool
+  moved). Both paths pinned by subprocess regression specs.
+
 ## [1.9.311.1] - 2026-10-06
 
 ### Fixed

data/ext/leptris/native/native.c

@@ -2682,15 +2682,21 @@ static VALUE nf_fast_inner_xml(VALUE self, VALUE addr)
  * Ruby-finalizer path (which stays for LEPTRIS_NO_NATIVE). */
 struct doc_handle {
     void *doc;
+    /* Pool ownership transferred to an absorber (engine #1548):
+     * the destination's free performs the real release, so this
+     * handle's dfree is HANDLE-ONLY (#386: malloc_zone_error /
+     * free_small_botch when an absorbed source survived to
+     * exit-time finalization after its destination's release). */
+    int absorbed;
 };
 
 static void dh_free(void *p)
 {
     struct doc_handle *h = p;
-    if (h->doc) {
+    if (h->doc && !h->absorbed) {
         f_doc_free(h->doc);
-        h->doc = NULL;
     }
+    h->doc = NULL;
 }
 
 static size_t dh_size(const void *p)
@@ -2888,6 +2894,22 @@ static VALUE nf_doc_handle_release(VALUE self, VALUE document)
     return Qnil;
 }
 
+/* Absorption bookkeeping (#386, engine #1548): Document#absorb
+ * calls this on the SOURCE right after the engine transfers pool
+ * ownership — the handle's dfree becomes handle-only, matching
+ * the Ruby-side Freed flag the no-native finalizer reads. */
+static VALUE nf_doc_handle_mark_absorbed(VALUE self, VALUE document)
+{
+    VALUE handle = rb_ivar_get(document, id_iv_doc_handle);
+    (void)self;
+    if (handle != Qnil) {
+        struct doc_handle *h;
+        TypedData_Get_Struct(handle, struct doc_handle, &dh_type, h);
+        h->absorbed = 1;
+    }
+    return Qnil;
+}
+
 /* The full Document.create in one dispatch: engine create,
  * binding wrapper (ivar-seeded, bypassing initialize), and the
  * lifetime handle. Returns Qnil when the engine refuses. */
@@ -3158,6 +3180,8 @@ LEPTRIS_INIT_EXPORT void Init_native(void)
                               nf_doc_handle_attach, 1);
     rb_define_module_function(m_native, "doc_handle_release",
                               nf_doc_handle_release, 1);
+    rb_define_module_function(m_native, "doc_handle_mark_absorbed",
+                              nf_doc_handle_mark_absorbed, 1);
     rb_define_module_function(m_native, "create_binding_document",
                               nf_create_binding_document, 0);
     c_doc_handle = rb_define_class_under(m_xml, "DocHandle", rb_cObject);

data/lib/leptris/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Leptris
-  VERSION = "1.9.311.1"
+  VERSION = "1.9.311.2"
 end

data/lib/leptris/xml/document.rb

@@ -11,7 +11,9 @@ class Leptris::XML::Document
   # the explicit `free` path and the finalizer. This eliminates the
   # double-free that FFI::AutoPointer's release proc caused when
   # `Document#free` was called explicitly and then GC ran.
-  Freed = Struct.new(:state)  # state: :alive | :freed
+  # +absorbed+ (engine #1548, #386): pool ownership moved to an
+  # absorber — the finalizer must never call the engine free.
+  Freed = Struct.new(:state, :absorbed)  # state: :alive | :freed
 
   # Mutation version: advanced by every data mutation (via
   # Node#ensure_writable!, root=, add_pi). Node memos stamp the
@@ -286,7 +288,7 @@ class Leptris::XML::Document
 
   def self.finalizer(address, freed)
     proc do
-      next if freed.state == :freed
+      next if freed.state == :freed || freed.absorbed
       freed.state = :freed
       Leptris::XML::FFI.leptris_document_free(::FFI::Pointer.new(address))
     end
@@ -591,8 +593,16 @@ class Leptris::XML::Document
   # objects by hand): the absorbed document's #free skips the
   # engine release, and splice seams skip source-side removals
   # because absorbed splices MOVE the node (nothing to remove).
+  # The flag is mirrored into every release path (#386): the
+  # shared Freed struct (the no-native Ruby finalizer reads it)
+  # and the C lifetime handle (dh_free must be handle-only when
+  # the pool belongs to the absorber).
   def mark_absorbed_into(destination)
     @absorbed_into = destination
+    @freed.absorbed = true
+    if defined?(Leptris::XML::NATIVE_FAST)
+      Leptris::XML::Native.doc_handle_mark_absorbed(self)
+    end
   end
 
   def absorbed_into?(destination)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: leptris
 version: !ruby/object:Gem::Version
-  version: 1.9.311.1
+  version: 1.9.311.2
 platform: arm-linux
 authors:
 - Ribose Inc.